Finding · F-ITGC-01
Unmitigated SoD conflict: payments approval and GL posting held by transferred employee
In ProgressSOD-01 · Segregation of incompatible duties in SAPSegregation of DutiesQ3 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low
Requirement to validation
Requirement
ISO-A.5.3 · ITGC-SOD-01 · RBI-ITGRCA-2023-7.1 · SOC2-CC5.2 · SOC2-CC6.3
mapped
Policy
Payments Security Policy
pol-payments
Control
SOD-01
Segregation of incompatible duties in SAP
Application
SAP S/4HANA
mapped
Evidence · Q3
2 items
2 approved · 0 pending · 0 rejected
Test · Q3
Fail
TST-ITGC-SOD-01 · Medium confidence
Finding
F-ITGC-01 · High
In Progress
Action
Priya Sharma
REM-F-ITGC-01 · In Progress
Validation
Pending
as recorded
Observation
Raised 2026-10-05 in the ITGC Q3 FY2026-27 Controls Testing (Meridian Internal Audit). Rohan Gupta moved Finance -> Operations effective 2026-09-15. 8 business days later SAP still assigns Z_FI_PAY_APPROVER (payments approval) and Z_FI_GL_POST (general ledger posting); Concur expense admin and vendor portal access also retained. Payments approval + GL posting is an unmitigated SoD conflict. Related controls: JML-02.
Applications: SAP S/4HANA.
Potential risk
Unauthorised or erroneous transactions could go undetected and expose Meridian to financial loss and regulatory action.
Root cause
Mover recertification depends on a manual manager action that was not triggered after the transfer.
Agreed action plan
Roles Z_FI_PAY_APPROVER and Z_FI_GL_POST to be removed by 2026-10-10; look-back review of all postings by the user since 2026-09-15 performed by Finance. Tracked as T-001, T-002 in Prismet Tasks.
Management response: Roles Z_FI_PAY_APPROVER and Z_FI_GL_POST to be removed by 2026-10-10; look-back review of all postings by the user since 2026-09-15 performed by Finance.
- Action
- REM-F-ITGC-01
- Owner (FPR)
- Priya Sharma
- Target date
- 10 Oct 2026
- Priority
- High
- Status
- In Progress
- Validation
- Pending · planned 10 Oct 2026
Evidence for this control (3)
| Evidence | Title | Control | Source system | Collected | Status |
|---|---|---|---|---|---|
| ITGC-REQ-016 | SAP S/4HANA: SoD ruleset — no unmitigated conflicts | SOD-01 | SAP S/4HANA | 4 Oct 2026 | Accepted |
| Q2-EV-013 | SAP S/4HANA · configuration report (Q2) | SOD-01 | SAP S/4HANA | 20 Jun 2026 | Rejected |
| RBI-REQ-012 | SAP S/4HANA: SoD ruleset — no unmitigated conflicts | SOD-01 | SAP S/4HANA | 4 Oct 2026 | Accepted |
Tests of this control (3)
| Test | Control | Cycle | Tested | By | Result | Confidence |
|---|---|---|---|---|---|---|
| TST-ITGC-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q3 2026 Unified Program Review | 5 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit | Fail | Medium |
| TST-RBI-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q3 2026 Unified Program Review | 5 Oct 2026 | Vikram Mehta, Farah Khan · Meridian Internal Audit (IS Audit cell) | Fail | Medium |
| TST-Q2-SOD-01 | SOD-01 · Segregation of incompatible duties in SAP | Q2 2026 Unified Program Review | 18 Jun 2026 | Farah Khan, Vikram Mehta · Meridian Internal Audit | Fail | Medium |